StarlingTek

Legal

Privacy policy

Draft, pending review. This is a starting draft that a lawyer hasn't reviewed yet. Effective date: November 9, 2026.

This policy explains what personal information [[LEGAL_ENTITY_NAME]] ("StarlingTek", "we", "us") collects, why, who else handles it, and how long we keep it. The short version: we collect what we need to talk to you, bill you and run your site, and nothing else. We don't sell it, and we don't use analytics or trackers.

1. This website

This site sets no cookies, uses no analytics or trackers, and loads nothing from third parties. It has no forms: the contact links open your own email app.

2. Server logs

Like almost every web server, ours keeps a log of the requests it receives. Here is exactly what the StarlingTek platform keeps, for this site and for the sites we host:

  • Access logs. Caddy, the web server in front of every site, writes an access log for each site. Each entry records the time, the visitor's IP address, the request method, the address and path requested, the response status and size, how long the response took, and the request headers Caddy records by default, such as the browser's user agent.
  • How long. Each site's access log rolls over when it reaches 20 MB, and only the five most recent rolled files are kept. Older entries are deleted as new traffic comes in, so how far back a log goes depends on how busy the site is, not on a fixed number of days. The logs for the platform's own admin and control addresses rotate too, using Caddy's standard rotation.
  • The application itself. The program behind this site doesn't log individual requests. The platform's own service log, which records deploys, errors and alerts, is kept for no more than two weeks and capped at 500 MB.
  • What we use them for. Fixing problems, spotting abuse and attacks, and counting each hosted site's requests and traffic for billing. We don't use them to build profiles of visitors, and we don't share them except as described in section 6.

Client status pages are not logged at all, because a status page's private link is its password.

3. What we collect

  • Contact details. When you email us, we get your name, email address and whatever you choose to write.
  • Billing details. For customers: the name, address and email on your invoices, what you've bought and what you've paid.
  • Account data for hosted sites. What we need to run your site: your domain, the repository we deploy from and its deploy key, your site's settings and secrets, deploy history, uptime checks, and usage figures (CPU, memory, disk and traffic) for billing.
  • Your site's content and data. Whatever your site stores, held on your behalf. See section 7.

4. How we use it

  • to reply to you and do the work you've asked for;
  • to host, monitor, back up, update and support your site;
  • to send invoices and keep billing records;
  • to send you service emails, such as go-live notices, alerts about your site, and notice of changes;
  • to keep the platform and our customers' sites secure;
  • to meet legal, tax and accounting obligations.

We don't send marketing email.

5. No selling, no trackers

We don't sell or rent personal information, and we don't share it for advertising. We don't use third-party analytics, tracking pixels or advertising cookies, on this site or on the platform. We don't use your data or your site's data to train AI models.

6. Who else handles it

We use a small number of providers to run the service. Each one only gets what it needs for its job:

  • Cloudflare: DNS for every hosted domain, and the proxy, for sites where it's turned on. When the proxy is on, visitor requests pass through Cloudflare.
  • DigitalOcean: the servers, managed databases and backup storage (Spaces) everything runs on.
  • Resend: delivery of the emails the platform sends, such as alerts and go-live notices.
  • GitHub: hosting for client code repositories, which the platform deploys from.
  • [[EMAIL_MAILBOX_PROVIDER]]: the mailbox that receives the email you send us.
  • [[PAYMENT_PROCESSOR]]: payment processing, when you pay an invoice online.

We may also disclose information if the law requires it, or to protect someone's safety, and we'll tell you about any such request if we're allowed to.

7. Your hosted site's visitors

If we host your site, the information your visitors give your site belongs to you, and you decide what happens to it. We handle it only on your behalf and only to run your site. We don't look at it unless you ask us to help with something that needs it. You're responsible for your own site's privacy notice to your visitors.

8. How long we keep it

  • Emails are kept while they're useful for the conversation or the work.
  • Billing records are kept for as long as tax and accounting rules require.
  • Account data is kept while you're a customer, then deleted with your site data when the service ends.
  • Server logs: see section 2.
  • Platform records: build logs for 30 days; uptime check results for 90 days; detailed usage samples for 48 hours and hourly figures for 90 days. Daily usage totals, which bills are based on, are kept with your billing records. Your application's own console output is kept in up to three 10 MB files per container, then overwritten.
  • Backups roll off as newer ones replace them: the server keeps the newest seven.

When the service ends, we delete your site data as set out in the terms.

9. Security

Every site is served over HTTPS. Each site runs in its own container, and the platform's management interfaces are private by default and need a password and an authenticator code. Changes are recorded in an audit log. The Security page describes the controls in detail. No system is perfectly secure, but if we learn that your information has been accessed without permission, we'll tell you without undue delay, say what we know, and say what we're doing about it.

10. Your rights

You can ask us to:

  • access the personal information we hold about you, and get a copy;
  • correct anything that's wrong;
  • delete it, unless we have to keep it (for example, billing records for tax).

Email us and we'll respond within 30 days. We won't charge you, and we won't treat you differently for asking. Depending on where you live, you may have other rights too; ask and we'll help.

11. Children

Our services are for businesses and adults. We don't knowingly collect personal information from children under 13. If you think a child has sent us their information, tell us and we'll delete it. Information on a site we host for you is handled under section 7.

12. Changes to this policy

If we change this policy, we'll update the effective date at the top. For a material change, we'll email our customers before it takes effect.

13. Contact

Questions about privacy, or a request under section 10: [email protected].

Post: [[LEGAL_ENTITY_NAME]], [[MAILING_ADDRESS]].